CVE-2019-9946: cncf portmap

CVSS: 7.5v3.0HighModified

AliasesRHBA-2019:0862UBUNTU-CVE-2019-9946DEBIAN-CVE-2019-9946

Published 02-04-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-9946 is a high (CVSS 7.5) vulnerability in cncf portmap. EPSS estimates a 3.16% chance of exploitation in the next 30 days, higher than 87.7% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.0 (NVD)

EPSS score

3.16%

0%100%

Low · -0.09 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

OPENSUSE-SU-2024:10884-1 RHSA-2019:3403

Timeline

02-04-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.07.5v2.05.0

EPSS trend

Probability

3.16%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

-0.09 pp

From 3.25% on 19-09-2026

19-09-202619-10-2026

EPSS score

3.16%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-670Always-Incorrect Control Flow ImplementationThe code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Affected systems

Redhat2 products

containernetworking-plugins< 0:0.7.5-2.el7
containernetworking-plugins-debuginfo< 0:0.7.5-2.el7

Cncf1 product

portmap< 0.7.5

Debian1 product

kubernetes< 1.17.4-1

Kubernetes1 product

kubernetes< 1.11.9 | ≥ 1.12.0, < 1.12.7 | ≥ 1.13.0, < 1.13.5 | 1.13.6:beta0 | 1.14.0:alpha0 | 1.14.0:alpha1 | 1.14.0:alpha2 | 1.14.0:alpha3 | 1.14.0:beta0 | 1.14.0:beta1 | 1.14.0:beta2 | 1.14.0:rc1

Netapp1 product